Trojanized Security Software Hits South Korea Users in Supply-Chain Attack

Cybersecurity researchers took the wraps off a novel supply
chain attack in South Korea that abuses legitimate security
software and stolen digital certificates to distribute remote
administration tools (RATs) on target systems.

Attributing the operation to the Lazarus Group, also known as
Hidden Cobra^[1], Slovak internet
security company ESET said^[2]
the state-sponsored threat actor leveraged the mandatory
requirement that internet users in the country must install
additional security software in order to avail Internet banking and
essential government services.

The attack, while limited in scope, exploits WIZVERA VeraPort,
which is billed as a “program designed to integrate and manage
internet banking-related installation programs,” such as digital
certificates issued by the banks to individuals and businesses to
secure all transactions and process payments.

The development is the latest in a long history of espionage
attacks against victims in South Korea, including Operation Troy^[3], DDoS attacks^[4]
in 2011, and against banking institutions^[5]
and cryptocurrency exchanges^[6] over the last
decade.

Aside from using the aforementioned technique of installing
security software in order to deliver the malware from a legitimate
but compromised website, the attackers used illegally obtained
code-signing certificates in order to sign the malware samples, one
of which was issued to the US branch of a South Korean security
company named Dream Security USA.

“The attackers camouflaged the Lazarus malware samples as
legitimate software. These samples have similar file names, icons
and resources as legitimate South Korean software,” ESET researcher
Peter Kálnai said. “It’s the combination of compromised websites
with WIZVERA VeraPort support and specific VeraPort configuration
options that allows attackers to perform this attack.”

Stating that the attacks target websites that use VeraPort —
which also comes with a base64-encoded XML configuration file
containing a list of software to install and their associated
download URLs — ESET researchers said the adversaries replaced the
software to be delivered to VeraPort users by compromising a
legitimate website with malicious binaries that were then signed
with illicitly acquired code-signing certificates to deliver the
payloads.

“WIZVERA VeraPort configurations contain an option to verify the
digital signature of downloaded binaries before they are executed,
and in most cases this option is enabled by default,” the
researchers noted. “However, VeraPort only verifies that the
digital signature is valid, without checking to whom it
belongs.”

The binary then proceeds to download a malware dropper that
extracts two more components — a loader and a downloader — the
latter of which is injected into one of the Windows processes
(“svchost.exe”) by the loader. The final-stage payload fetched by
the downloader takes the form of a RAT that comes equipped with
commands allowing the malware to perform operations on the victim’s
filesystem and download and execute auxiliary tools from the
attacker’s arsenal.

What’s more, the campaign appears to be what’s a continuation of
another Lazarus-mounted attack called Operation BookCodes^[7]
detailed by the Korea Internet & Security Agency earlier this
April, with significant overlaps in TTPs and command-and-control
(C2) infrastructure.

“Attackers are particularly interested in supply-chain attacks,
because they allow them to covertly deploy malware on many
computers at the same time,” the researchers concluded.

“Owners of [websites with VeraPort support] could decrease the
possibility of such attacks, even if their sites are compromised,
by enabling specific options (e.g. by specifying hashes of binaries
in the VeraPort configuration).”